125 for Windows, Mac, and Linux systems also patches 15 other security vulnerabilities, 12 of which are rated 'high' and two 'low' in severity. Finally, in the pop-up window, check the box below and select Chrome. In the menu, click Open with another application. To do this, locate a PDF file in the file browser. You can use your browser to open PDF files by default. Website owners, for their part, are recommended to use nonce and hash capabilities of CSP for added security.īesides this, the latest Chrome update. Chrome comes with a full-featured PDF reader. While the implications of the vulnerability remain unknown, users must update their browsers to the latest version to protect against such code execution. 'Having a vulnerability in Chrome's CSP enforcement mechanism doesn't directly mean that sites are breached, as the attackers also need to manage to get the malicious script called from the site (which is why the vulnerability was classified as medium severity),' PerimeterX's Gal Weizman noted. It's worth noting that websites like Twitter, Github, LinkedIn, Google Play Store, Yahoo's Login Page, PayPal, and Yandex were not found vulnerable since the CSP policies were implemented using a nonce or hash to allow the execution of inline scripts.

The flaw discovered by Tencent and PerimeterX circumvents the configured CSP for a website by merely passing a malicious JavaScript code in the 'src' property of an HTML iframe element.

Google chrome hack august